1
vote
1answer
72 views

Combining cascaded encryption keys into one key

Is there an encryption algorithm where it's possible to combine multiple encryption keys into one, so that: $E_{AB}(Data) = E_A(E_B(Data))$ KeyAB should be computable from KeyA and KeyB, but it must ...
0
votes
1answer
90 views

Knowing N and a relationship between the 2 prime numbers(p and q) find p and q generated with RSA

Let there be $p$ and $q$, 2 prime numbers for which the following relationship is true: $|p-q| < 2 \cdot N^{1/4}$. The algorithm first generates the prime number $p$, then it generates $q$ close ...
0
votes
2answers
92 views

Integrity compromised - HASH modified

As we are all aware that HASHing is user to verify integrity in cryptography. I have a query about hashing. Suppose a man in the middle attacker manipulates the data and creates new HASH (by running ...
0
votes
1answer
275 views

Multiple AES/ECB encryptions of different data with same key all end with same pattern

We have used "AES/ECB/PKCS5Padding" with a 256 bit key. We encrypt different streams of data (blockwise) with the same key. Each encrypted stream ends with same pattern. What is the reason for this?
1
vote
1answer
55 views

Is authentication length always a subset of encryption length?

Do in all the use cases, if I have to encrypt and authenticate, encrypt-then-authenticate or authenticate-then-encrypt, like in IPSEC, SSL or SSH or others, if I were to do these operations to a ...
1
vote
1answer
317 views

Vigenère, auto-correlation vs Kasiski examination

What are the differences between 'Kasiski examination' and 'auto-correlation' ? In Cryptool site, they state that autocorrelation analysis is more efficient and clearer than the Friedman or Kasiski ...
3
votes
2answers
391 views

Key space vs Cardinality of 1024-bit RSA

I have been trying to figure out the encryption key space, and cardinality of 1024-bit RSA. From my understanding, the key generated from 1024-bit will be primes greater than $2^{1023}$ but less than $...
0
votes
1answer
95 views

Are keys generated by the user or block cipher algorithms themselves? [closed]

We know block cipher algorithms. In the block cipher algorithms, Key Scheduling is the one crucial part. I see that in some simulation programs of the AES,DES,TripleDES encryption algorithms. In those,...
1
vote
1answer
184 views

Finding Vigenère cipher key(s) [closed]

How can we find the key used with a Vigenère cipher in small number of steps? If we have text like: Peit Wokm! Mhfa fepatgb ets bvvrvxmea ebte bae twkd qiqi ...
0
votes
1answer
68 views

How do I control an access code safely?

Upon registration an user has to specify an access code of five digits. This access code is also used as a password for the encryption and decryption of certain strings. The user types in "12345" (...
6
votes
1answer
128 views

Verifying Diffie–Hellman parameters someone else generated

I am auditing some software that includes compiled in Diffie–Hellman parameters (2048 bits). I can't be sure who generated the DH parameters or how they were generated. Question: Can DH ...
1
vote
1answer
331 views

RSA modulus (N) from public key and calculating N from p, q not equal [closed]

I have a RSA public key in the form of public exponent and modulus as follows: ...
1
vote
0answers
53 views

EC based password authenticated key exchange protocol

I would like to know: What is the currently best (efficiency and security wise) known EC based password authenticated key exchange protocol? (i.e. is there any EC based protocol may be similar to DH ...
3
votes
2answers
1k views

nonce of AES-GCM in SSL

It seems that the nonce of AES-GCM in SSL has 3 parts: salt, 4 bytes, generated in handshake, not changed in whole session nonce_explicit, 8 bytes, chosen by the sender and carried in each SSL ...
0
votes
1answer
67 views

Why perfect secrecy can be ensured when a plain message and a cipher-text based on one-time pad are correlated?

First, some well-known results are as follows. For random variables $X$ and $Y$, we have $$H(X,Y) \leq H(X) + H(Y).$$ The equality is achieved when $X$ and $Y$ are independent. Second, in one-time ...
1
vote
2answers
84 views

Fortuna: why are source ID and data length added together with entropy data into the pools

Section 9.5.6 of Cryptography Engineering states that The concatenation [of source number, length of data, and data itself] is then appended to the pool. Why are we including source number and ...
0
votes
1answer
93 views

What is the meaning of h(r) in this protocol?

Could somebody tell me what the meaning is of $h(r)$ in the protocol below? ‎‎$A‎\leftarrow‎{B}\quad:{h(r)‎‎}{,B}{,P{_A(r,B)}}‎ \\A‎\rightarrow‎{B}\quad:r$
7
votes
1answer
141 views

Factoring two RSA moduli $N_i=p_i\cdot q_i$ knowing that $p_2=p_1+2$?

It is given two RSA moduli $N_1$ and $N_2$, known to be of the form $N_i=p_i\cdot q_i$, with $p_i$ and $q_i$ unknown primes, and such that $p_2=p_1+2$. Can we make use of that relation to factor the ...
-1
votes
1answer
60 views

What does L_n is the bit length of the group order n states need for my calculation in ECDSA algorithm?

I am doing the program of implementing ECDSA for which I am trying to solve the equation scenario. In ECDSA that signature generation algorithm which states as hash value from the SHA-1 and where $l$ ...
0
votes
2answers
174 views

Asymmetric encryption that is secure for (almost) any foreseeable future

Recently, I've been reading a couple of papers about building cryptosystems that are secure for up to 30 years. But for some applications, this seems a bit low to me. So I am wondering if considering ...
1
vote
0answers
263 views

Is chaotic encryption secure? [closed]

I know this sounds too broad. But I noticed that there was a chapter on chaotic crypto in the recent Handbook of Information and Communication Security Editors: Stavroulakis, Peter, Stamp, Mark (Eds.) ...
6
votes
3answers
417 views

Is there a way to use bcrypt with passwords longer than 72 bytes securely?

From my understanding BCrypt truncates the password to 72 bytes. If a password is longer than 72 bytes, what is a way to store that password using bcrypt securely without compromising it? Or is this ...
4
votes
2answers
310 views

Inserting a backdoor into a cryptographic hash function

I'm curious as to how a backdoor can be built into a hash function. What might it take the form of? What's probability of getting one that can be backdoored in a way that can actually undermine its ...
8
votes
3answers
243 views

What is a Key Derivation Function?

From Wikipedia: In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or ...
5
votes
2answers
146 views

Encrypt-Mix-Encrypt: Full Diffusion?

I've read "A Parallelizable Enciphering Mode" by Halevi and Rogaway about the encrypt-mix-encrypt mode for ciphers and was asking myself if this mode provides "full" diffusion. So if an attacker ...
1
vote
0answers
45 views

why are both ipad and opad required for HMAC? [duplicate]

I was reading about HMAC and why it is crucial to avoid security issues with normal prepending / appending the secret k to a message (issues due to merkel damagard construction). I am not familiar ...
1
vote
1answer
72 views

Are there equivalent IVs in DES/CBC?

I'm playing around with the CryptoPP library with DES/CBC and I've noticed that for some sets of data, if I decrypt the ciphertext with Key1, IV1, I get a good cleartext result -- but if I decrypt the ...
1
vote
1answer
257 views

Choosing finite field size in Shamir's Secret Sharing Scheme

The Wikipedia article on Shamir's Secret Sharing says to that to have information theoretical security the splitting algorithm should be evaluated using finite field arithmetic on the field $\rm{GF}(p)...
3
votes
1answer
348 views

Weaker alternative to Ed25519?

For me, the main advantages of Ed25519 are that it avoids patents (by computing in one dimension) and that it is fast. However, the 128bit security of Ed25519 is sometimes too strong to comply with ...
1
vote
1answer
108 views

Value of S and r in Fiat-Shamir Protocol

In the book Cryptography and Network Security by Forouzan,in chapter 14, Fiat-Shamir protocol, its mentioned that two large prime numbers p and q are chosen and kept secret. However n=p*q is made ...
2
votes
1answer
107 views

RFID Protocol Cryptanalysis

Assume we have the following scheme for RFID: TAG & READER both have initially k keys. Every session the TAG computes $k_i$=F($k_{i-1})$ where F is a function which computes XOR of previous key ...
1
vote
1answer
52 views

Errata for NIST SP 800-63

I'm looking through the latest version of NIST SP 800-63, and there is a table (Table A.1) in the Appendix that supposed give the "entropy" of a password for a 94 character alphabet for various ...
1
vote
1answer
166 views

Benefit of using random key in Shamir's Secret Sharing

I am implementing Shamir's Secret Sharing, and I find that in (t,n)-threshold scheme, the shares are just using 1,2,3...,n as the key to form the shares ...
0
votes
1answer
495 views

SSL / TLS digital signature exchange

If server is sending its digital signature, in which message / where does the digitally signature is provided to the client. Is it after the server_hello message because there the public key of the ...
1
vote
1answer
182 views

Meaning of Signature hash algorithm field in certificate

I'd like to understand what is the meaning of this field, especially considering that when calling a crypto library to sign data the digest method is specified by the caller. For example, this simple ...
1
vote
1answer
74 views

Rationale of “r” AES key use in OTR version 3 AKE protocol?

I just tried to review & understand AKE (Authenticated Key Exchange) protocol as defined in OTR secure messaging protocol version 3 here , and aiming to achieve Perfect Forward Secrecy I am a ...
2
votes
1answer
1k views

How does the Blowfish algorithm key initialization work

I'm having some trouble understanding the Blowfish encryption algorithm. From the Wikipedia article... The secret key is then, byte by byte, cycling the key if necessary, XORed with all the P-...
2
votes
0answers
112 views

Standards/RFCs for non-Diffie-Hellman perfect forward secrecy?

Some time has passed since PFS introduction and we now have secure&proven asymmetric ciphers that can generate strong keys very efficiently (elliptic RSA variants and/or QD-Mceliece can generate ...
3
votes
1answer
150 views

Secure ElGamal with OAEP

Is it possible to make ElGamal IND-CCA2 using OAEP or OAEP+? (OAEP+ from: "OAEP Reconsiderd" by Shoup) The reason I ask is that I recently answered this question and it came to my mind that OAEP or ...
0
votes
0answers
29 views

AES-XTS: find key from ciphertext and plaintext [duplicate]

Let's say I have a plaintext, the corresponding ciphertext encrypted using AES-XTS, and the initialization vectors. Is there any way - not brute force, of course - to compute the key? Even if there's ...
1
vote
1answer
91 views

Prove there is PRG that is not necessarily one-to-one

We assume that there is at least one PRG .Now prove there is a PRG like $G:\{0,1\}^{n} \rightarrow \{0,1\}^{l(n)} $ such that it is not necessarily one-to-one.
1
vote
1answer
198 views

CTR_DRBG versus OFB_DRBG

As far as I know, in the development of ANSI X9.82, there was consideration of OFB_DRBG, a pseudorandom number generator based on block ciphers like CTR_DRBG, but it appears to have been rejected of ...
4
votes
0answers
361 views

Looking for C++/Python Open Source code library for cryptanalysis of classical ciphers [closed]

I've done a significant amount of coding over the years working on classical ciphers (e.g., Chaocipher, D'Agapeyeff). My main programming languages today are C++ and Python, although there was a time ...
4
votes
0answers
100 views

Is the key schedule of Serpent a circle?

The creation of the prekeys for Serpent works by XORing some previous values with a counter and a fixed value. Every word is 32 bits big and 4 words form a round key (after applying a S-Box, but this ...
3
votes
0answers
95 views

How to recover $e$ from $f_A(e) = Ae \mod q$ when knowing trapdoor

I have a silly question, but I don't know a solution, so I need to question. Assume, with a algorithm $TrapGen(1^\lambda)$, it generates $A\in\mathbb{Z}_q^{n\times m}$ with a basis $B \in\mathbb{Z}_q^...
0
votes
1answer
529 views

AES Mix Columns and Shift Rows

Why we use Mix Columns and Shift Rows in AES? FOr example, if i want implement an AES algorithm without Mix Columns and Shift Rows what is the difference in the ciphertext?
1
vote
3answers
88 views

Why do we get the following equation in case of a One Time Pad?

If m: message, M: message space, k: key, K: keyspace, c: cipher, C: cipher space and $E_k$: encryption function, such that $E_k(m) = c,\ m,m^* \in M,\ k\in K,\ c\in C.$ My first question is, is the ...
1
vote
1answer
76 views

Zero knowledge proof relation + number is binary

I want to develop a ZKPK for the following problem: $$Y=g_0^{r_Y} \prod_{i=1}^n g_i^{s_i}$$ and $$Z=h_0^{r_Z} \prod_{i=1}^n h_i^{s_i}$$ I want to proof knowledge of $r_Y,r_Z$ and $s_i$ which I have ...
1
vote
1answer
61 views

Using similar passwords and salts for PBKDF2

I'm trying to generate a bunch of pseudo-random keys for AES using PBKDF2, where the AES ciphers will be used in CTR mode as pseudo-random number generators. My goal is to create a 2-dimensional array,...
0
votes
0answers
43 views

Would a pictographic, phoneme-based, hand cipher be difficult to crack with computer crypt-analysis?

What I'm talking about is a hand cipher which uses phonemes instead of individual characters and pictograms instead of the usual shuffling/substitution methods (e.g Caesar, Solitare, Vignere). The ...

15 30 50 per page